Use lua filters with `services.cgit`

[aforemny]

Describe the bug

I am trying to use lua filters with services.cgit, in particular lua filters that require lua libraries. I've only found a non-intuitive solution to make this work.

Steps To Reproduce

Steps to reproduce the behavior:

1. Let's assume we want to include cgit's email-libravatar.lua as an email filter. This lua script depends on the lua module luaossl.
2. The following configuration causes the following error being logged when accessing a commit in cgit, where the email filter is run.

configuration:

{
  services.cgit.main.enable = true;
  services.cgit.main.settings.email-filter = "lua:${pkgs.cgit}/lib/cgit/filters/email-libravatar.lua";
}

error:

fcgiwrap: fatal: Lua error in /nix/store/.../lib/cgit/filters/email-libravatar.lua: .../lib/cgit/filters/email-libravatar.lua:10: module 'openssl.digest' not found:
fcgiwrap:         no field package.preload['openssl.digest']
fcgiwrap:         no file './share/lua/5.1/openssl/digest.lua'
fcgiwrap:         no file './openssl/digest.lua'
fcgiwrap:         no file './openssl/digest/init.lua'
fcgiwrap:         no file './lib/lua/5.1/openssl/digest.so'
fcgiwrap:         no file './openssl/digest.so'
fcgiwrap:         no file './lib/lua/5.1/loadall.so'
fcgiwrap:         no file './lib/lua/5.1/openssl.so'
fcgiwrap:         no file './openssl.so'
fcgiwrap:         no file './lib/lua/5.1/loadall.so'

Expected behavior

I would expect to have a documented/ non-obscure way to use lua filters in cgit that use lua modules.

Overriding luagit in cgit does not alleviate the error, presumably (but I haven't checked), because cgit links against lua, instead of calling our wrapper binary. Ie. extending above configuration with the following does not alleviate the problem.

{
  services.cgit.main.package = pkgs.cgit.override { luajit = pkgs.luajit.withPackages (luaPackages: [ luaPackages.luaossl ]); };
}

Additional context

I've come up with the following work-around.

{
  services.cgit.main.package = pkgs.symlinkJoin {
      name = "cgit";
      paths = [
        pkgs.cgit
        (pkgs.luajit.withPackages (luaPackages: [ luaPackages.luaossl ]))
        (pkgs.runCommandLocal "cgit-lua-packages" { } ''
          mkdir -p $out/cgit
          ln -s ../lib $out/cgit/lib
          ln -s ../share $out/cgit/share
        ''
        )
      ];
    };
}

This works, because fcgiwrap executes cgit with ${pkgs.cgit}/cgit as working directory.

Note that libravatar.lua imports openssl/digest, which is found in share, which in turn loads _openssl.so, which is found in lib.

How could we approve upon this? Ideally, I would like the luajit override in services.cgit.main.package to work, or expose services.cgit.*.luaPackages as a configuration option. For that to be robust, I feel we should control fcgiwrap's working directory better, ie. specify it to be ${pkgs.cgit} instead of ${pkgs.cgit}/cgit?

Or is there a simple solution that I've missed? Thank you for your input!

Notify maintainers

@bjornfor (package maintainer)

Metadata

This was tested on nixos-23.11, rev 84d981bae8b5e783b3b548de505b22880559515f.

---

Add a :+1: reaction to issues you find important.

[bjornfor]

I'm afraid I won't be of much help here, but I have two things to say:

1. I remember having a related issue: how to get a custom python env (suitable for source highlighting) into cgit. I've been running this ever since:

  services.lighttpd = {
    ...
    # Inject a python that can be used for this cgitrc snippet:
    # source-filter=${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py
    extraConfig = lib.mkAfter ''
      $HTTP["url"] =~ "^/cgit" {
        setenv.add-environment += (
          ${let
              pythonEnv = pkgs.python3.buildEnv.override {
                extraLibs = with pkgs.python3Packages; [ pygments ];
              };
              cgitPath = with pkgs; lib.makeBinPath [ pythonEnv ];
            in ''
            "PATH" => "${cgitPath}:" + env.PATH
          ''}
        )
      }
    '';
    ...

2. According to git log, these people also have interest in cgit: @schnusch, @alyssais, @Mindavi.